CVE-2021-23041

On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

PT-2021-15367

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x through 16.1.x Description A directory traversal issue exists in an undisclosed page of the BIG-IP Configuration utility, allowing an attacker to access arbitrary files. Recommendations For versions 11.6.x through 16.1.x...

CVE-2021-23037: Improper Neutralization of Input During Web Page Generation

On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note:...

PT-2021-15364

Name of the Vulnerable Software and Affected Versions BIG-IP AFM versions 12.1.x BIG-IP AFM versions 13.1.x before 13.1.4.1 BIG-IP AFM versions 14.1.x before 14.1.4.2 BIG-IP AFM versions 15.1.x before 15.1.3 BIG-IP AFM versions 16.0.x before 16.0.1.2 Description A SQL injection issue exists in an...

PT-2021-15361

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x through 16.1.x Description A reflected cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility, allowing an attacker to execute JavaScript in the context of the currently logged-i...

CVE-2021-23027: Improper Neutralization of Input During Web Page Generation

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user...

CVE-2021-23038: Improper Neutralization of Input During Web Page Generation

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in...

PT-2021-15354

Name of the Vulnerable Software and Affected Versions F5 Advanced Web Application Firewall WAF versions 16.0.x through 16.0.1.2 Description Insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery SSRF attacks through the F5 Advance...

CVE-2021-23043: Improper Limitation of a Pathname to a Restricted Directory

On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of...

PT-2021-15362

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 12.1.x F5 BIG-IP versions 13.1.x through 13.1.4.1 F5 BIG-IP versions 14.1.x through 14.1.4.2 F5 BIG-IP versions 15.1.x through 15.1.3.1 F5 BIG-IP versions 16.0.x through 16.0.1.2 Description A stored cross-site scripting XSS...

PT-2021-15352

Name of the Vulnerable Software and Affected Versions BIG-IP versions 14.1.x through 14.1.4.3 BIG-IP versions 15.1.x through 15.1.3.1 BIG-IP versions 16.0.x through 16.0.1.2 Description A DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration...

PT-2021-15365

Name of the Vulnerable Software and Affected Versions BIG-IP versions 12.1.x BIG-IP versions 13.1.x before 13.1.4.1 BIG-IP versions 14.1.x before 14.1.4.2 BIG-IP versions 15.1.x before 15.1.3 BIG-IP versions 16.0.x before 16.0.1.2 Description A DOM based cross-site scripting XSS vulnerability...

CVE-2021-23041: Improper Neutralization of Input During Web Page Generation

On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

PT-2021-15356

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x before 11.6.5.3 BIG-IP versions 12.1.x before 12.1.6 BIG-IP versions 13.1.x before 13.1.4 BIG-IP versions 14.1.x before 14.1.4.1 BIG-IP versions 15.1.x before 15.1.3 BIG-IP versions 16.0.x before 16.0.1.2 Description An...

PT-2021-15350

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.6.x BIG-IP versions 12.1.x BIG-IP versions 13.1.x through 13.1.3.4 BIG-IP versions 14.1.x through 14.1.3.0 BIG-IP versions 15.1.x through 15.1.0.4 Description An authenticated remote command execution issue exists in the...

CVE-2021-23031: Improper Neutralization of Special Elements used in an OS Command

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. Note: Software versions which...

CVE-2021-23040: Improper Neutralization of Special Elements used in an SQL Command

On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This issue is exposed only when BIG-IP AFM is provisione...

CVE-2021-23025: Improper Neutralization of Special Elements used in an OS Command

On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support EoTS ar...

CVE-2021-23029: Server-Side Request Forgery (SSRF)

On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery SSRF attacks through F5 Advanced Web Application Firewall WAF and the BIG-IP ASM Configuration utility. Note: Software versions which have...

ROS-2-842

2.842 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...